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Device for recording data, record earner and method for recording data 



The invention relates to a device for recording data on a track of a record 
carrier, which record carrier comprises a first keylocker which holds information about the 
data and a second keylocker which holds the same information, which two keylockers are 
positioned adjacent to each other on the track, the device comprising invalidating means for 

5 invalidating the keylockers. 

The invention further relates to a record carrier having a track for recording 
data, the record carrier comprising a first keylocker which holds information about the data 
and a second keylocker which holds the same information, the two keylockers being 
positioned adjacent to each other on the track. 

1 0 The invention also relates to a method of recording data on a track of a record 

carrier, which record carrier comprises a first keylocker which holds information about the 
data and a second keylocker which holds the same information, the two keylockers being 
positioned adjacent to each other on the track, the method comprising a step of invalidating 
the keylockers. 

15 

As copying of data in the form of copyrighted material from one record carrier 
to an other becomes more and more easy, the need for proper protection of that data becomes 
greater. An example of a scheme to protect data uses a so called keylocker. In a keylocker all 

20 secrets, e.g. usage rights, keys, counters, an unique identification of the disc or any 

information are stored in the keylocker in a tamper free way. Usage rights can for instance be 
the rights to play or copy the data on the record carrier. A keylocker is encrypted with a so 
called keylocker key. It is common to have two or more identical copies of the keylocker on 
the record carrier. If one keylocker is damaged, the other keylocker can be used. The 

25 keylockers are commonly placed adjacent to each other. 

An example of data that can be protected is music. The keylocker can contain 
the right to copy the music once. After making a copy the keylocker is updated indicating 
that no longer a copy can be made. If the record carrier is a write once record carrier, or if the 
data is written on the record carrier in a similar way as with a write once record carrier, the 
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updating of the keylocker is done by writing new keylockers and invalidating the old ones. 
On a write once record carrier invalidating can be done by damaging the keylockers with a 
laser pulse having a sufficient high power level. A problem with this invalidation is that also 
the data directly adjacent to the keylockers will be damaged or will be inaccessible. The 
directly adjacent data can be damaged when the data is written interleaved on the record 
carrier. Interleaved writing means that the data is not written continuously but in blocks, 
where the blocks are written with a spacing between them. That spacing can for example be 
two or three blocks of other data. When data is invalidated, then units of data are invalidated 
that do not coincide with the interleave blocks. Therefore also data adjacent to the keylocker 
is invalidated. The data directly adjacent to the keylocker can also become inaccessible when 
the keylocker is invalidated because of the following reason. When a device such as an 
optical recorder wants to access certain target data on the record carrier, then it does not jump 
directly to the target address of that data, but on a previous address before the target address. 
This is done because the optical recorder then has time to settle before the target data is read. 
But when the data on the previous address is invalidated, then the target data is inaccessible. 

It is an object of the invention to provide a device and method for recording 
data which is able to invalidate the keylockers without making the neighboring data 
inaccessible. 

It is also an object of the invention to provide a record carrier which contains 
keylockers that can be invalidated without making the neighboring data inaccessible. 

For this purpose, the device as described in the opening paragraph is 
characterized in that the invalidating means are able to invalidate the keylockers by 
invalidating an identical part of the information of the first keylocker and of the second 
keylocker and the information of the first keylocker being arranged differently from the 
information of the second keylocker in that the information that is to be invalidated of at least 
one keylocker is positioned closer to the other keylocker as compared to a situation where the 
information of the keylockers is arranged identically. The record carrier described in the 
opening paragraph is characterized in that the keylockers can be invalidated by invalidating 
an identical part of the information of the first keylocker and of the second keylocker and the 
information of the first keylocker is arranged differently from the information of the second 
keylocker in that the information that is to be invalidated of at least one keylocker is 
positioned closer to the other keylocker as compared to a situation where the information of 



PHNL0203 1 5EPP 

1 3 23.04.2002 
the keylockers is arranged identically. The method described in the opening paragraph is 
characterized in that the step of invalidating the keylockers invalidates die keylockers by 
invalidating an identical part of the information of the first keylocker and of the second 
keylocker and the information of the first keylocker being arranged differently ftom the 
information of the second keylocker in that the information that is to be invalidated of at least 
one keylocker is positioned closer to the other keylocker as compared to a situation where the 
information of the keylockers is arranged identically. 

It is sufficient to invalidate only a part of the keylocker to disable the use of 
the keylocker. When the same part of all the keylockers is disabled it is not possible to 
retrieve the whole keylocker. However, when disabling for example the first part of both 
keylockers, the data preceding the first keylocker will also be disabled. Disabling the first 
part of the keylockers is preferable, because in practice the space reserved for the keylocker 
could be greater than the keylocker needs, resulting in the last part of the space reserved for 
the keylocker is not used. Disabling the last part would result in that the information of the 
whole keylocker is still retrievable. If the first part of the first keylocker is arranged closer to 
the other adjacent keylocker, then that first part is further away from the preceding data and 
the preceding data will not be damaged. This ensures a better integrity of the preceding data 
after invalidation. In an embodiment the keylocker contains usage rights of the data. These 
rights can for instance be the right to copy the data once. 

In an embodiment of the recording device the information that is to be deleted 
of the first keylocker is directly adjacent to the information that is to be deleted of the second 
keylocker. This has the advantage that the information that is to be deleted is as far as 
possible away from the data directly neighboring the keylockers, thereby minimizing the 
chance of making the neighboring data inaccessible. 

In an other embodiment the information contained in the keylockers is divided 
into sectors. The part of the information that is to be invalidated preferably comprises the last 
sectors of the first keylocker and the first sectors of the second keylocker. 

In a further embodiment the record carrier comprises more than two 
keylockers which are adjacent to each other and the first keylocker and the second keylocker 
are the two outermost keylockers. Here again the part of the information that is invalidated is 
further away from the neighboring data. The arrangement of the information of the 
keylockers between the first and second keylocker is not important 
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These and other aspects of the invention will be apparent from and elucidated 
further with reference to the embodiments described by way of example in the following 
description and with reference to the accompanying drawings, in which 
Fig. 1 shows a recording device, 
Fig. 2 shows an example of a keylocker area structure, 
Fig. 3 a shows an example of two identical keylockers, 
Fig. 3b shows an other example of two identical keylockers, 
Fig. 4 shows a schematic of the process of writing new keylockers and 
invalidating the old keylockers, 

Fig. 5 shows an example of a corrupted sector which is directly adjacent to the 
invalidated sectors. 



Figure 1 shows an embodiment of a recording system having a record 
carrier 1, rotating means 4 and a transducer 2. The transducer 2 can for instance be an optical 
pickup unit. An optical pickup unit transmits a radiation beam 3 which is reflected by the 
record carrier 1 . The record carrier 1 in this example contains the data on a track 5 (see 
Fig.2), which track 5 can consists of pits that will or will not reflect the radiation beam 3. 
Also other physical elements than pits which result in reflecting or not reflecting the radiation 
beam 3 can be used for holding data on the track 5. The reflected radiation beam 3 is 
converted by the transducer into a signal that is further processed by further processing 
means in the recording device. The further processing means converts the signal from the 
transducer 2 into a reproduction signal which can be an audio signal for instance. The 
recording device also comprises invalidation means 20. The invalidation means 20 are 
connected to the transducer 2 to invalidate the keylockers. In this embodiment the record 
system is also capable of playing back a record carrier 1. In an other embodiment the 
recording system is capable of recording data to a record carrier 1, but not capable of playing 
back a record carrier 1 . 

In Figure 2 a track 5 which holds a so called keylocker area 1 1 is depicted. In 
this case the keylocker area 1 1 resides in the program area of the track. The program area is 
the area where the user data 6 is stored on the track 5. The track 5 in this example also has an 
unrecorded area 10. The program area thus comprises the user data 6, the keylocker area 1 1 
and the unrecorded area 10. The keylocker area 1 1 consists of a first keylocker 7, a second 
keylocker 8 and a further information area 9. The further information area 9 contains an 
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adaptation layer parameter space ALP, and may contain an enabling key block EKB and may 
contain a black list BL. The ALP structure contains pointers to the keylockers. The EKB is a 
data structure that is used to communicate a secret crjnptographic key to a set of authorized 
devices or PC applications. The BL is a list containing identifiers of devices or other entities 
that have been declared invalid. 

In Figure 3a and Figure 3b two examples are shown of the keylockers 7 and 8 
on a record carrier 1 according to the invention. In Figure 3a the keylockers 7 and 8 consist 
of eight sectors each. Each sector in this example contains two kilobytes of information. In 
Figure 3b the keylockers 7 and 8 consist of 168 sectors each. The information contained in 
the keylockers 7 and 8 usually is encrypted. The encrypted information is stored in the 
keylockers starting from sector 1 to the last sector. Of course not all sectors need to contain 
encrypted information. Therefore when the keylockers need to be invalidated by invalidating 
an identical part of the encrypted information of both keylockers, the safest sectors to 
invalidate are the sectors with the lowest numbers. In this example sectors 1 and 2 are 
invalidated. The encrypted information of the keylockers shown in Figure 3a and 3b are 
arranged so that sectors 1 and 2 of the first keylocker 7 are directly adjacent to the sectors 1 
and 2 of the second keylocker 8. In this way there are six sectors between the invalidated 
sectors and the neighboring data, which is the maximal number of sectors if two sectors of 
the keylockers need to be invalidated. In Figure 3b there are even more sectors between the 
invalidated sectors and the neighboring data. This ensures the integrity of the neighboring 
data after invalidation of the keylockers. Of course also other sectors and/or an other number 
of sectors can be invalidated. The sectors of the first keylocker 7 and the second keylocker 8 
that need to be invalidated do not have to be adjacent, but this has the advantage that there 
are a maximum number of sectors between the invalidated sectors and the neighboring data. 
This also has the further advantage that the invalidation process is relatively simple because 
the sectors can be invalidated with one continuous laser action. 

In Figure 4 an example is shown of a track 5 which contains a first invalidated 
keylocker 7i and a second invalidated keylocker 8i. Also the further information area 9o is 
not used anymore. Two new keylockers 7 and 8 are written on an other location on the track 
5. Also a new further information area 9 is written, because that further information area 9 
contains pointers to the new keylockers. If the EKB and the BL need not to be updated then 
these structures can be maintained in the old further information area 9o. The new further 
information area 9 then contains pointers to the EKB and BL. 
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In Figure 5 an example is shown of a sector which is directly adjacent to a 
sector that has been invalidated. The data in the sector depicted in Figure 5 was not intended 
to be invalidated or damaged. But because the adjacent sector (not depicted in Figure 5) is 
invalidated, the data in the sector depicted in Figure 5 is damaged by accident. The reason for 
5 the damaging can be that the data is written interleaved and that by invalidating the 
keylocker, also neighboring data is invalidated. The data in the sector is depicted in a 
hexadecimal representation. The data which is accentuated with the black boxes is corrupted 
as a consequence of the invalidation of the adjacent sector. This clearly shows that 
invalidation must not be done directly adjacent to data which must be left intact. 

1 0 Although the invention has been explained mainly by embodiments of an 

optical recording device, similar embodiments of recording devices are suitable which have 
the characteristic that when invalidating data on the record carrier, also data adjacent to the 
invalidated data becomes damaged. Also for the record carrier an optical disc can be used or 
other media such as a magnetic disc or tape can be used. It is noted, that in this document the 

15 word 'comprising' does not exclude the presence of other elements or steps than those listed 
and the word 'a' or 'an' preceding an element does not exclude the presence of a plurality of 
such elements, that any reference signs do not limit the scope of the claims, that the invention 
may be implemented by means of both hardware and software, and that several 'means' may 
be represented by the same item of hardware. Further, the scope of the invention is not 

20 limited to the embodiments, and the invention lies in each and every novel feature or 
combination of features described above. 
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CLAIMS: 25. 2001 



1. Device for recording data on a track of a record carrier, which record carrier 
comprises a first keylocker which holds information about the data and a second keylocker 
which holds the same information, which two keylockers are positioned adjacent to each 
other on the track, the device comprising invalidating means for invalidating the keylockers, 

5 characterized in that the invalidating means are able to invalidate the keylockers by 
invalidating an identical part of the information of the first keylocker and of the second 
keylocker and the information of the first keylocker being arranged differently ftom the 
information of the second keylocker in that the information that is to be invalidated of at least 
one keylocker is positioned closer to the other keylocker as compared to a situation where the 

10 information of the keylockers is arranged identically. 

2 , Device as claimed in claim 1 , characterized in that the information about the 
data comprises information about the usage rights of the data. 

15 3 , Device as claimed in one of the preceding claims, characterized in that the 

information is divided into sectors and that the information that is to be invalidated consists 
of one or more sectors per keylocker. 

4. Device as claimed in one of the preceding claims, characterized in that the 
20 information that is to be deleted of the first keylocker is directly adjacent to the information 

that is to be deleted of the second keylocker. 

5 . Device as claimed in claim 3, characterized in that the information that is to be 
deleted are the last two sectors of the first keylocker and the first two sectors of the second 

25 keylocker. 

6. Device as claimed in one of the preceding claims, characterized in that the 
record carrier comprises more than two keylockers which are adjacent to each other and that 
the first keylocker and the second keylocker are the two outermost keylockers. 
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7. Record carrier having a track for recording data, the record carrier comprising 
a first keylocker which holds information about the data and a second keylocker which holds 
the same information, the two keylockers being positioned adjacent to each other on the 

5 track, characterized in that the keylockers can be invalidated by invalidating an identical part 
of the information of the first keylocker and of the second keylocker and the information of 
the first keylocker is arranged differently from the information of the second keylocker in 
that the information that is to be invalidated of at least one keylocker is positioned closer to 
the other keylocker as compared to a situation where the information of the keylockers is 
1 0 arranged identically. 

8. Record carrier as claimed in claim 7, characterized in that the information 
about the data comprises information about the usage rights of the data. 

15 9. Record carrier as claimed in one of the claims 7 and 8, characterized in that the 

information is divided into sectors and that the information that is to be invalidated consists 
of one or more sectors per keylocker. 

1 0. Record carrier as claimed in one of the claims 7 to 9, characterized in that the 
20 information that is to be deleted of the first keylocker is directly adjacent to the information 

that is to be deleted of the second keylocker. 

1 1 . Record carrier as claimed in claim 9, characterized in that the information that 
is to be deleted are the last two sectors of the first keylocker and the first two sectors of the 

25 second keylocker. 

12. Record carrier as claimed in one of the claims 7 to 1 1, characterized in that the 
record carrier comprises more than two keylockers which are adjacent to each other and that 
the first keylocker and the second keylocker are the two outermost keylockers. 

30 

13. Method of recording data on a track of a record carrier, which record carrier 
comprises a first keylocker which holds information about the data and a second keylocker 
which holds the same information, the two keylockers being positioned adjacent to each 
other on the track, the method comprising a step of invalidating the keylockers, characterized 



10 
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in that the step of invalidating the keylockers invalidates the keylockers by invalidating an 
identical part of the information of the first keylocker and of the second keylocker and the 
information of the first keylocker being arranged differently from the information of the 
second keylocker in that the information that is to be invalidated of at least one keylocker is 
positioned closer to the other keylocker as compared to a situation where the information of 
the keylockers is arranged identically. 

14. Method as claimed in claim 13, characterized in that the information about the 
data comprises information about the usage rights of the data. 

15. Method as claimed in one of the claims 13 and 14, characterized in mat the 
information is divided into sectors and that the information that is to be invalidated consists 
of one or more sectors per keylocker. 

15 16> Method as claimed in one of the claims 13 to 15, characterized in that the 

information that is to be deleted of the first keylocker is directly adjacent to the information 
that is to be deleted of the second keylocker. 

17. Method as claimed in claim 15, characterized in that the information that is to 
20 be deleted are the last two sectors of the first keylocker and the first two sectors of the second 

keylocker. 

1 8. Method as claimed in one of the claims 13 to 17, characterized in that the 
record carrier comprises more than two keylockers which are adjacent to each other and that 

25 the first keylocker and the second keylocker are the two outermost keylockers. 
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ABSTRACT: 




A device and method for recording data on a track (5) of a record carrier (1) is 
described. Also the record carrier (1) for use in such a device and method is described. The 
record carrier (1) contains two identical keylockers (7, 8). The keylockers contain encrypted 
information about the usage rights of the data on the record carrier (1). When these usage 
rights need to be updated, the keylockers are invalidated and new keylockers are written. 
Invalidating the old keylockers on a write once record carrier (1) can be done by a laser pulse 
wilh a high power level. However, data directly adjacent to the information that is invalidated 
becomes inaccessible. Therefore only a part of Ihe keylockers (7, 8) is invalidated. This part 
needs to be an identical part of both keylockers (7, 8) so that the information of the whole 
keylocker can not be restored. The distance between the neighboring data and the part of the 
keylocker that is invalidated is increased by arranging the information of the first keylocker 
(7) differently from the information of the second keylocker (8) in that the information that is 
to be invalidated of at least one keylocker is positioned closer to the other keylocker as 
compared to a situation where the information of the keylockers (7, 8) is arranged identically. 
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